Hash Generator

What the Hash Generator Does

A hash function turns any input — a word, a password, a whole file of text — into a fixed-length string that works as a fingerprint of that data. The same input always produces the same hash, and any change at all to the input produces a completely different one, which is what makes hashes useful for checking that data has not been corrupted or altered. That is why a hash creator is closer to a fingerprint machine than an encoder: run the same text through this hash calculator twice and you get the identical result both times.

This online hash generator computes MD5, SHA-1, SHA-256 and SHA-512 for any text at once, in your browser. As a SHA hash generator it covers all three SHA variants alongside MD5, so you do not need a separate tool for each.

How to Use the Hash Generator

• Type or paste your text into the Input box, or click Paste to take it from your clipboard.

  

• Click Generate. All four hashes — MD5, SHA-1, SHA-256 and SHA-512 — are calculated at once.

  

• Each hash has its own Copy button, so you can take just the one you need.

  

• Compare the value against the one you are checking, character for character.

  

• Click Clear to empty the input and the four results and start again.

  

• Everything is calculated in your browser using standard hashing algorithms — your text is never sent to a server.

What Is a Hash?

• One-way — data can be mapped to a hash, but a hash cannot be mapped back to the data.
• Fixed-length output, whatever the input length — hash a single sentence and hash an entire book and both come back the same number of characters.
• Deterministic — the same input gives the same hash every time, on any system.
• MD5 — 128-bit output, shown as 32 hexadecimal characters.
• SHA-1 — 160-bit output, shown as 40 hexadecimal characters.
• SHA-256 — 256-bit output, shown as 64 hexadecimal characters. This is the current standard for most checksum and verification work.
• SHA-512 — 512-bit output, shown as 128 hexadecimal characters, used where the strongest collision resistance is wanted.
• MD5 and SHA-1 are cryptographically broken and should not be used for passwords, signatures or anything security-sensitive. SHA-256 and SHA-512 are the safe defaults today.

When You Would Use This

• Checking that a downloaded file was not corrupted or tampered with, by comparing its hash against the one the publisher lists.
• Telling whether two files are identical without opening either of them.
• Producing a hash of some text or data to use as a cache key or for deduplication.
• Validating a Git commit or a package checksum against the value it should have.
• Generating non-security checksums during development or QA.
• Working out what a hash value you have run into — in a log, on a download page, in a config file — actually is.
• Showing how the output length and format differ between MD5, SHA-1, SHA-256 and SHA-512.

Worked Example

Input: Hello, World!

Each algorithm returns a completely different length and value from the same input, and changing a single character — dropping the exclamation mark, say — would change all four hashes entirely, with no visible relationship between the old and new values. That is the avalanche effect, and it is what makes a hash a reliable way to spot even the smallest change in data.

Hashing in Code

JavaScript — SHA-256 via the Web Crypto API

async function sha256(text) {
  const data = new TextEncoder().encode(text);
  const hashBuffer = await crypto.subtle.digest("SHA-256", data);
  return Array.from(new Uint8Array(hashBuffer))
.map(b => b.toString(16).padStart(2, "0"))
.join("");
}

Command Line

echo -n "Hello, World!" | md5sum
echo -n "Hello, World!" | shasum -a 256

Do’s and Don’ts

Do

Use SHA-256 or SHA-512 for any checksum or integrity check that matters.

Compare two hashes exactly, character for character — a single differing character means the data is different.

Verify the integrity of downloaded or transferred files with a hash.

Treat a hash as a fingerprint of data, not as a way of storing or retrieving it.

Don’t

Use MD5 or SHA-1 for anything security-critical — passwords, digital signatures or similar.

Expect a hash to be “decoded” back to the original text. It is one-way by design.

Store passwords with a plain hash function such as MD5 or SHA-256 — use bcrypt, scrypt or Argon2, which are built for the job.

Confuse hashing with encryption. Encryption can be undone with a key; hashing cannot be undone at all.

Common Mistakes

• Using hashing as encryption. A hash cannot be decrypted or reversed — the two solve different problems.
• Still reaching for MD5 or SHA-1 out of habit. Both are obsolete for security because of collision weaknesses, though they remain fine for basic non-security checksums.
• Hashing passwords directly. Plain hash functions are far too fast and are easily brute-forced; password-specific functions such as bcrypt are deliberately slow and salted.
• Comparing hashes by eye instead of programmatically. Long hex strings are easy to misread — use exact string matching rather than glancing at the first and last few characters.

Good to Know

• The avalanche effect is what happens when a tiny change to the input — one character, even a single space — produces a completely different hash with no visible relationship to the original.
• SHA-256 is the current default for general-purpose checksums: secure, and still fast enough for everyday use.
• MD5 has been deprecated for security use since 2011, but is still widely used for non-security purposes such as cache keys and duplicate detection.
• The output length never changes with the input. SHA-256 returns 64 hexadecimal characters whether you hash one word or a whole book.
• SHA-1 and SHA-2 (which covers SHA-256 and SHA-512) are standardised by NIST, so they behave identically across platforms and languages.

Frequently Asked Questions